Google Chrome EUVD-2026-100649

Exploitation requires the victim to actively load attacker-controlled web content in Chrome - the CVSS UI:R and the description's 'crafted HTML page' confirm user interaction (navigating to or being redirected to a malicious/compromised page) is mandatory; it is not a zero-click flaw. The vulnerability lies in Chrome's Media component, so the malicious page must deliver media content that drives the vulnerable code path. The primary limiting factor is that code execution is confined to the renderer sandbox (S:U, 'inside the sandbox'): absent a separately chained sandbox-escape vulnerability, the attacker does not directly gain host-level code execution. No authentication is required (PR:N), and default Chrome configurations are affected (no non-default setting is named).

Signals are largely consistent and point to a genuinely serious but not yet emergency-level issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U, C:H/I:H/A:H, base 8.8) describes network-reachable, unauthenticated, low-complexity code execution that requires only that a victim load a crafted HTML page - the classic drive-by browser exploitation profile. The scope-unchanged (S:U) metric aligns precisely with the description's key qualifier that code executes 'inside the sandbox,' meaning this is a renderer-level RCE without a confirmed sandbox escape, so blast radius is limited unless chained with a separate sandbox-escape bug. Counterbalancing the high CVSS, EPSS is very low at 0.21% (11th percentile), the CVE is NOT on CISA KEV, and no public exploit was identified in the provided data, so there is no evidence of current real-world exploitation. The low EPSS is typical for a freshly-disclosed Chrome use-after-free that has not yet been weaponized publicly; it does not contradict the high severity. Net: this is a real patching priority because Chrome's ubiquity and UAF bugs' historical exploitability make it an attractive target, but at time of analysis it is a 'patch promptly, not drop-everything' item rather than an actively-exploited emergency.

An attacker hosts or compromises a web page containing malicious media content that triggers the use-after-free in Chrome's Media component when rendered. A victim running a vulnerable Chrome version (prior to 155.0.8059.79) simply visits the page, and the attacker gains arbitrary code execution within the constrained renderer sandbox. No public exploit code was identified at time of analysis, and low attack complexity (AC:L) means no special timing or environmental conditions are required beyond getting the victim to load the content.